Seiden Group Blog - Page 29 of 30

A simple security measure

July 7, 2010/2 Comments/in Apache, PHP, Web development /by Alan Seiden

A reader recently asked me this security question:

If a user enters:
http://<my_ip>/<mydirectory>
instead of
http://<my_ip>/<mydirectory>/script.php

They get a listing of all scripts/files in that directory and they can then select and execute/run those scripts.

This is a real concern for us, any suggestions?

The solution is to turn off directory browsing in your Apache configuration. To do this, make sure your Apache configuration file (probably httpd.conf or .htaccess) includes this directive:

Options -Indexes

Note that this directive merely prevents people from discovering the names of your files. Users who already know your file names can still access them. But Options -Indexes provides an important layer of security, preventing mischief from casual users who might otherwise stumble onto your file names by accident or design.

More information: http://httpd.apache.org/docs/2.2/mod/core.html#options

See me speak about web services and Zend Framework

May 25, 2010/1 Comment/in News & Events /by Alan Seiden

Join me at at Long Island PHP on June 7, 2010, where I’ll present a case study showing how I integrated Windows-based data into an IBM i-based application using SOAP with Zend Framework.

The principles are the same no matter what type of servers you use.

There will be plenty of time for questions and discussion.

Hope to see you there!

P.S. To see the slides from my past presentations, go to https://www.seidengroup.com/presentations/.

Differences Between Zend Core and Zend Server on IBM i

April 21, 2010/6 Comments/in IBM i, PHP, Web development /by Alan Seiden

UPDATE: As of 2020, we recommend using Seiden PHP on IBM i and LINUX for reliability, speed, and ease of maintenance.

	Zend Core	Zend Server
Installation folder	/usr/local/zend/core	/usr/local/zendsvr
PHP.INI	/usr/local/zend/core/etc	/usr/local/zendsvr/etc
Web server root(s)	/www/zendcore, /usr/local/zend/apache2	/www/zendsvr
Document root	/www/zendcore/htdocs	/www/zendsvr/htdocs
Zend Framework	/usr/local/Zend/ZendFramework	/usr/local/zendsvr/share/ZendFramework
PHP binaries folder * * where php and php-cli reside	/usr/local/zend/core/bin	/usr/local/zendsvr/bin
PHP Log files	/usr/local/zend/core/logs	/usr/local/zendsvr/ var/log
Web user profile (assign authority to it)	NOBODY	QTMHHTTP
Default HTTP Port	:89	:10088
Admin Interface URL	http://yourIBMi:89/ZendCore/	http://yourIBMi:10088/ZendServer/
Menu (5250)	GO ZENDCORE/ZCMENU	GO ZENDSVR/ZSMENU

If the new HTTP port of 10088 seems hard to remember, you can change it to something that’s easier to work with, such as the standard HTTP port of 80. To do that, edit /www/zendsvr/conf/httpd.conf and change Listen *:10088 to Listen *:80 or whatever you want. (Of course, first ensure that no other service is running on that IP/Port combination.)

Zend Server for IBM i Is Here

April 21, 2010/0 Comments/in IBM i, PHP, Web development /by Alan Seiden

UPDATE: As of 2020, we recommend using Seiden PHP on IBM i and LINUX for reliability, speed, and ease of maintenance.

Zend and IBM have announced an updated, streamlined version of their PHP package for IBM i, called Zend Server. I’ve been using the beta for a while but last week read an announcement showing it’s ready for general use. It combines the best of Zend Core and Zend Platform in one package.

To get Zend Server, go to the Zend Server for IBM i page and click the green “Free Download” button. This will give you the “Community Edition (CE)” version, the free version that handles all the basics for running PHP on IBM i. It even comes with a year of free online support.

If you want to upgrade to the non-CE version (it doesn’t have its own name), which gives you more debugging and tracing tools, as well as Job Queue functionality and more support, you can buy a license. Write to me if you need help or want to buy a license for the non-CE version.

PHP for Batch Tasks on IBM i

April 21, 2010/1 Comment/in PHP /by Alan Seiden

Last night I gave a talk at the FASUG user group about how to use PHP as a powerful general utility language that can be called from CL programs on the IBM i. I also showed how Zend Server’s new Job Queue feature can accomplish similar goals–scheduling and automating PHP scripts–using a pure PHP interface rather than CL.

I also discussed the IBM i’s latest PHP package: Zend Server for IBM i. I explained its similarities to and differences from Zend Core.

Here are the PowerPoint slides.

Class ‘Zend_Db_Table’ not found

March 4, 2010/1 Comment/in PHP, Web development /by Alan Seiden

An up-to-date PHP installation is critical for security and performance. Request your complimentary PHP Upgrade Assessment with Alan.

New developers sometimes struggle with putting all of Zend Framework’s pieces together. This week someone asked me how to resolve the error:

Fatal error: Class ‘Zend_Db_Table’ not found.

The answer: he needs to “require” the file containing the Zend_Db_Table class, like so:

require_once 'Zend/Db/Table.php';

1	require_once 'Zend/Db/Table.php';

or (my preference) use the autoloader:

// ZF 1.8 or later: add these lines to your bootstrap file:
require_once 'Zend/Loader/Autoloader.php';
$loader = Zend_Loader_Autoloader::getInstance()->setFallbackAutoloader(true);

1

2

3

// ZF 1.8 or later: add these lines to your bootstrap file:

require_once 'Zend/Loader/Autoloader.php';

$loader = Zend_Loader_Autoloader::getInstance()->setFallbackAutoloader(true);

ZF isn’t complicated if you know the few things you MUST use. The autoloader is one of them.

If you need help getting started with Zend Framework, contact me about Zend Framework mentoring, training, or troubleshooting.

Zend Server beta for PHP on IBM i: I like it

February 3, 2010/0 Comments/in IBM i, PHP /by Alan Seiden

UPDATE: As of 2020, we recommend using Seiden PHP on IBM i and LINUX for reliability, speed, and ease of maintenance.

I’m recommending that people try Zend Server beta for IBM i if they’re using PHP on the IBM i. Even though it’s in beta, Zend Server brings improvements over its predecessors, Zend Core and Zend Platform. Improvements include:

Easy new user interface combining the best of Core and Platform
Better interface makes it easier for people to discover and use features such as code tracing and debugging
Elimination of mandatory proxy server (always a thorn in my side!)
Use of IBM’s supported, full-featured, flexible Apache server rather than the limited PASE server
Better performance

One caveat: the current beta version (as of February, 2010) is missing some functionality that will be available in the generally available (GA) release. Temporarily missing functionality includes:

no support for the mail() function (use Zend_Mail or Phpmailer instead in the meantime)
inclusion of an older version of the ibm_db2 driver. This version doesn’t have support for the “i5_libl” option. Ask Zend to send you the updated db2 driver if you need it.

I’m looking forward to trying the next beta version and eventually the GA release.

I believe Zend Server will shorten the learning curve for new users and simplify advanced configurations for us “veterans.”

Download it here: Zend Server beta for IBM i

PHP on IBM i (and me) at ZendCon 2009

September 29, 2009/0 Comments/in IBM i, PHP /by Alan Seiden

This year’s ZendCon (Oct. 20-22, 2009, in San Jose, Calif.), the premier PHP conference, features several presentations about developing with PHP on the IBM i, including one by me!

Come hear me speak about “Zend Framework for Enterprise PHP on IBM i” on Tuesday, Oct. 20, 2009, at 4pm.

For details, go to http://www.zendcon.com.

Our Zend Framework-based Site Honored by IBM/COMMON

May 21, 2009/0 Comments/in IBM i, News & Events, PHP, Web development /by Alan Seiden

UPDATE: As of 2020, we recommend using Seiden PHP on IBM i and LINUX for reliability, speed, and ease of maintenance.

We won! IBM has recognized my use of PHP and Zend Framework, and our entire team’s RPG/DB2 and design work, by naming our web solution the IBM i’s most innovative of 2009.

At IBM’s 2009 COMMON conference, IBM awarded the Power Systems Innovation Award for Best Web Solution for eBiz@ABG. The site, developed with my colleagues at Strategic Business Systems, Inc., was created for New Jersey’s largest wine and spirits wholesaler, Allied Beverage Group.

The system offers product ordering, live inventory levels and pricing, and a full-text search of Allied’s large product catalog. The application was built with Zend Framework (the leading PHP framework) and runs entirely on Allied’s IBM i, leveraging Allied’s db2 database and time-tested RPG logic.

The site is password-protected, so unfortunately I can’t link to it here.

eBiz@ABG is one of the first sites to be built with Zend Framework on IBM i (System i, i5, iSeries, AS/400). It was a true collaboration with Allied, made easier because we all spoke the language of “i.” What’s more, by using large chunks of Allied’s existing RPG code that already handled the complex business logic, we saved time and avoided reinventing the wheel.

Zend Framework worked so well that I committed to mastering it and teaching the community about it. (ZF has a learning curve, but after that curve is mastered, ZF speeds development and offers easy maintenance and growth.) I earned my Zend Framework certification in August 2008, becoming one of the first 50 worldwide to do so and the first ZF-certified “i” professional. Since then, I’ve gone on to be a ZF/i mentor for other development teams, and have become a public speaker, sharing my PHP/ZF/i roadmap at conferences.

Thanks to Allied for the opportunity to collaborate on a great project; thanks to Strategic Business Systems for the support; and thanks to IBM for the award.

Why Use a PHP Framework?

June 25, 2008/3 Comments/in PHP, Web development /by Alan Seiden

At last night’s NY-PHP gathering, a fellow PHP’er and I discussed PHP frameworks. I told her I was developing an e-commerce site using Zend Framework. She replied that she’d been considering frameworks, especially Cake and Symfony, “but I’m not sure I need a framework at all. I write my own SQL; my apps work fine. What would a framework do for me?”

Setting aside the differences between PHP frameworks, I’m aware of at least 4 reasons to use them:

Modular design: A home-grown application, with its ad hoc growth, can become a tangled mess that’s hard to change or enhance. Most mainstream frameworks provide a modular design that makes it easier to modify or add components.
Flexible components: Sure, you can write your own authorization class in PHP, but why reinvent the wheel? The framework will provide an integrated component that handles not only your current needs, but requirements that you haven’t yet encountered (but that the framework’s community has). With a framework, chances are that you won’t have to redesign your authorization system when the users ask for something new.
Best practices: As you use the framework, you’ll begin to absorb the practices and (we hope) good habits of the framework’s creators.
New capabilities: Frameworks regularly add functionality to help developers implement new technology. These days, common enhancements involve AJAX and connections to the APIs of popular web service providers.

Developers may understandably wonder if mastering a framework is worth the learning curve. In my opinion, the effort to learn a framework will be repaid with applications that are well structured, flexible, and easily maintained.